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Abstract. The Kepler conjecture asserts that no packing of congruent 
balls in three-dimensional Euclidean space has density greater than that 
of the face-centered cubic packing. The original proof, announced in 
1998 and published in 2006, is long and complex. The process of revision 
and review did not end with the publication of the proof. This article 
summarizes the current status of a long-term initiative to reorganize 
the original proof into a more transparent form and to provide a greater 
level of certification of the correctness of the computer code and other 
details of the proof. A final part of this article lists errata in the original 
proof of the Kepler conjecture. 
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Introduction 



In 2006, Discrete and Computational Geometry devoted an issue to the proof 
of the Kepler conjecture on sphere packings, which asserts that no packing 
of congruent balls in three-dimensional Euclidean space can have density 
greater than that of the face-centered cubic packing [22] , [13] , [S] , [IS] , [5] • 

The proof is long and complex. The editors' forward to that issue remarks 
that "the reviewing of these papers was a particularly enormous and daunt- 
ing task." "The main portion of the reviewing took place in a seminar run at 
Eotvos University over a 3 year period. Some computer experiments were 
done in a detailed check. The nature of this proof, consisting in part of 
a large number of inequalities having little internal structure, and a com- 
plicated proof tree, makes it hard for humans to check every step reliably. 
Detailed checking of specific assertions found them to be essentially cor- 
rect in every case tested. The reviewing process produced in the reviewers a 
strong degree of conviction of the essential correctness of the proof approach, 
and that the reduction method led to nonlinear programming problems of 
tractable size." 



The process of review and revision did not end when the proof was pub- 
lished. This article summarizes the current status of a long-term initiative 
to reorganize the original proof into a more transparent form and to provide 
a greater level of certification of the correctness of the computer code and 
other details of the proof. 

The article contains two parts. The first part describes an initiative to 
give a formal proof of the Kepler conjecture. The second part gives errata 
in the original proof of the Kepler conjecture. Most of these errata are 
minor. However, a significant new argument appears in a separate section 
(Section|8]). It finishes an incomplete argument in the original proof asserting 
that there is no loss in generality in assuming (for purposes of the main 
estimate) that subregions are simple polygons. The incomplete argument 
was detected during the preparation of the blueprint edition of the proof, 
which is described in Section |2j 

In this article, the original proo/ refers to the proof published in [55]. S. 
Ferguson and T. Hales take full responsibility for every possible error in the 
original proof of the Kepler conjecture. Over the past decade, many have 
contributed significantly to making that proof more reliable. 
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Part 1. Formal Proof Initiative 

1. The Flyspeck project 

The purpose of a long-term project, called the Flyspeck project, is to give a 
formal proof of the Kepler conjecture. This section makes some preliminary 
remarks about formal proofs and gives a general overview of the current 
status of this project. 

1.1. Formal proof. A formal proof is a proof in which every logical in- 
ference has been checked, all the way back to the foundational axioms of 
mathematics. No step is skipped no matter how obvious it may be to a 
mathematician. A formal proof may be less intuitive, and yet is less suscep- 
tible to logical errors. Because of the large number of inferences involved, a 
computer is used to check the steps of a formal proof. 

It is a large labor-intensive undertaking to transform a traditional proof into 
a formal proof. The first stage is to expand the traditional proof in greater 
detail. This stage fills in steps that a mathematician would regard as obvi- 
ous, works out arguments that the original proof leaves to the reader, and 
supplies the assumed background knowledge. In a final stage, the detailed 
text is transcribed into a computer-readable format inside a computer proof 
assistant. The proof assistant contains mathematical axioms, logical rules 
of inference, and a collection of previously proved theorems. It validates 
each new lemma by stepping through each inference. No other currently 
available technology is able to provide levels of certification of a complex 
mathematical proof that is remotely comparable to that available by formal 
computer verification. A general overview of formal proofs can be found 

at m, m- 

Proof assistants differ in detail in the way they treat the formalization of 
a theorem that is itself a computer verification (such as the proof of the 
four color theorem or the proof of the Kepler conjecture). In general, a 
formal proof of a computer verification can be viewed as a formal proof of 
the correctness of the computer code used in the verification. That is, the 
formal proof certifies that the the code is a bug-free implementation of its 
specification. 

1.2. Formal proof of the Kepler conjecture. As mentioned above, the 
purpose of the Flyspeck project is to give a formal proof of the Kepler 
conjecture. (The project name Flyspeck comes from the acronym FPK, for 
the Formal Proof of the Kepler conjecture.) This is the most complex formal 
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proof ever undertaken. We estimate that it may take about twenty work- 
years to complete this formahzation project. 

The Flyspeck project is introduced in the article [TSJ- The project page 
gives the latest developments [T7] . The project is now at an advanced stage; 
in fact, we estimate that the project is now about half-way complete. One 
of the main purposes of this article is to present a summary of the current 
status of this project. 

In the original proof of the Kepler conjecture, there was a long mathematical 
text and three major pieces of computer code. The written part of the 
proof has been substantially revised with aims of the Flyspeck project in 
mind. Section [2] compares this revised text with the original. There is now 
a good match between the mathematical background assumed in the text 
and the mathematical material that is available in the proof assistant HOL 
Light. Section |3] describes the current level of support in HOL Light for the 
formalization of Euclidean space and measure theory. In the years following 
the publication of the original proof, S. McLaughlin has reworked and largely 
rewritten the entire body of code in a form that is more transparent and more 
amenable to formalization. Section [4] points out some difficulties in verifying 
the computer code in its original form and documents the reimplementation. 

There have been three Ph.D. theses written on the Flyspeck project, one 
devoted to each of the three major pieces of computer code. The first piece 
of computer code uses interval arithmetic to verify nonlinear inequalities. R. 
Zumkeller's thesis [49j develops nonlinear inequality proving inside the proof 
assistant Coq. Section [5] gives an example of this work. The second piece of 
computer code enumerates all tame graphs. (The definition of tameness is 
rather intricate; its key property is that the set of tame graphs includes all 
graphs that give a potential counterexample to the conjecture.) G. Bauer's 
thesis, together with subsequent work with T. Nipkow, completes the formal 
proof of the enumeration of tame graphs [36]. Section [6] gives a summary of 
this formalization project. The third piece of computer code generates and 
runs some 10^ linear programs. These linear programs show that none of the 
potential counterexamples to the Kepler conjecture are actual counterexam- 
ples. S. Obua's thesis develops the technology to generate and verify the 
linear programs inside the proof assistant Isabelle [35j. Section [7] describes 
this research. 

The ultimate aim is to develop a complete formal proof of the Kepler con- 
jecture within a single proof assistant. Because of the scope of the prob- 
lem and the number of researchers involved, different proof assistants have 
been used for different parts of the proof: HOL Light for background in Eu- 
clidean geometry and the text, Coq for nonlinear inequality verification, and 
Isabelle/HOL for graph enumeration and linear programming. This raises 
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the issue of how to translate a formal proof automatically from one proof 
assistant to another. Implementations of automated translation among the 
proof assistants HOL, Isabelle, and Coq can be found at |32] . |47] . 

2. Blueprint edition of the Kepler conjecture 

The blueprint edition of the proof of the Kepler conjecture is a second- 
generation proof that contains far more explicit detail than the original 
proof. The blueprint edition is available at [TS] , [H] . Many proofs have been 
significantly simplified and systematized. It has been written in a manner 
to permit easy formalization. As its name might suggest, this version is 
intended as a blueprint for the construction of a formal proof. This section 
compares the blueprint edition with the original. 

2.1. Lemmas in elementary geometry. A collection of about 200 lem- 
mas that can be expressed in elementary terms has been extracted from 
the original proof and placed in a separate collection |19j . This has several 
advantages. First of all, these lemmas, although elementary, are precisely 
the parts of the original proof that put the greatest burden on the reader's 
geometrical intuition. (Many of these lemmas deal with the existence or 
non-existence of configurations of several points in subject to various 
metric constraints.) Also, the lemmas can be stated without reference to 
the Kepler conjecture and all of the machinery that has been introduced to 
give a proof. Finally, the proofs of these lemmas rely on similar methods 
and are best considered together [16] . Section |3] on Enhanced Automation 
gives an approach to proving the lemmas in this collection. 

These lemmas can be expressed in the first-order language of the real num- 
bers; that is, they can be expressed in the syntax of first-order logic with 
equality (allowing quantifiers Vx, 3x with variables running over the real 
numbers), the real constants 0, 1, and ring operations (-I-), (— ), (•) on M. 
In fact, L. Fejes Toth's statement of the Kepler conjecture as an optimiza- 
tion problem in a finite number of variables can itself be expressed in the 
first-order language of the real numbers |[35l. (For this, the truncation used 
by L. Fejes Toth must be modified slightly so that the truncated Voronoi 
cells are polyhedra.) Thus, it should come as no surprise that many of the 
intermediate lemmas in the proof can also be expressed in this manner. 

For example, consider the statement asserting the existence of a circumcenter 
of a triangle: if three points in the plane are not coUinear, then there exists 
a point in the plane that is equidistant from all three. This can be expressed 
in elementary terms as follows: for every (xi,yi), {x2,y2)-, (a^3,?/3)j if there 
do not exist ti,i2, and is for which ti(xi,yi) +t2{x2-,y2) +h{xz-,y?i) = (0,0) 
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and ti + t2 + ts = 1, then there exists (x, y) such that 

{x - xi)^ + {y - yif = {x- X2f + {y - y2f = {x - x^f + {y - yzf- 



2.2. Background material. There is now a close match between what the 
blueprint edition assumes as background and what the proof assistant HOL 
Light provides, as described in Section [3] The blueprint edition develops 
substantial background material in trigonometry, measure and integration, 
hypermaps, and fans (a geometric realization of a hypermap). It turns out 
that only a small number of primitive volumes need to be computed for the 
proof of the Kepler conjecture. These primitives include the volume of a 
ball, a tetrahedron, and right circular cone. No line or surface integrals are 
required. 

A hypermap consists of three permutations e, n, / (on a finite set D) that 
compose to the identity e o n o f = I . A hypermap is the combinatorial 
structure used by Gonthier in his formal proof of the four color theorem. In 
2005, the proof of the Kepler conjecture was rewritten in terms of hyper- 
maps, because it is better suited for formal proofs than planar graphs. 

The Jordan curve theorem (JCT) has been formalized as a step in the Fly- 
speck project |i20j. In fact, something weaker than the JCT suffices. The 
project only uses the JCT for curves on the surface of a unit sphere consist- 
ing of a finite number of arcs of great circles; that is, a spherical polygonal 
version of the JCT. In the proof of the Kepler conjecture, the combinatorial 
structure of a cluster of spheres is encoded as a hypermap. An Euler char- 
acteristic calculation, based on the JCT, shows that these hypermaps are 
planar. The planarity of these hypermaps is a crucial property that is used 
in the enumeration of tame graphs (Section |6]). The background chapter in 
the blueprint edition contains detailed proofs of these facts. 

The blueprint edition contains several introductory essays that introduce 
the main concepts in the proof, including the algorithms implemented by 
the computer code. 

The formalization of the blueprint text started in 2008 with work of J. Rute 
(CMU) and the Hanoi Flyspeck group. The current members of this group 
are Tran Nam Trung, Nguyen Tat Thang, Hoang Le Trudng, Nguyen Quang 
Trudng, Vu Khac Ky, Nguyen Anh Tam, Nguyen Tuyen Hoang, Nguyen Dijfc 
Phuong, Vudng Anh Quyen, Phan Hoang Chon, and managed by Ta Thi 
Hoai An. The blueprint formalization is still at an early stage. 
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3. Formalizing the ordinary mathematics 

This section describes some of the work on formaHzing EucHdean space and 
measure theory, and the development of further proof automation, which 
should be useful in this endeavor. 

The computer code in Flyspeck has so far received the lion's share of the 
formal effort. This is entirely reasonable since there are, or at least were, 
real questions about the feasibility of reproducing these results in a formal 
way. However, the Flyspeck proof includes a large amount of 'ordinary' 
mathematics, which also needs to be formalized. Here we are on fairly 
safe ground in principle, because by now we understand the formalization 
of mainstream mathematics quite well [4_8j. It is safe to predict that this 
formalization can be done, and we can even hope for a reasonably accurate 
estimate of the effort involved. Nevertheless, the formalization is certainly 
non-trivial and will require considerable work. 

3.1. Formalizing Euclidean space. Much of our work has been devoted 
to developing a solid general theory of Euclidean space M.^ [25] . For Fly- 
speck, we invariably just need the special case M'^. While some concepts, 
e.g. vector cross products, are specific to M^, most of the theory has been 
developed for general M.^ so as to be more widely applicable. The theorem 
prover HOL Light [21] is based on a logic without dependent types, but we 
can still encode the index as a type (roughly, an arbitrary indexing type 
of size A^). This means that theorems about specific sizes like 3 really are 
just type instantiations of theorems for general stated with polymorphic 
type variables. The theory contains the following: 

• Basic properties of vectors in M^, linear operators and matrices, di- 
mensions of vector subspaces and other bits of linear algebra. For 
example, the following is a formal statement of the theorem that a 
square matrix A' is a left inverse to another one A iff it is a right 
inverse. Note that the double use of the same type variable N con- 
strains the theorem to square matrices: 

I- VA:real-N-N A':real-N-N. (A ** A' = mat 1) ^ (A' ** A = mat 1) 

• Metric and topological notions like distances, open sets, closure, 
compactness and paths. Some of these are very general, others are 
more specific to Euclidean space. Some results include the Heine- 
Borel theorem, the Banach fixed-point theorem and Brouwer's fixed- 
point theorem. The following is a formal statement that continuous 
functions preserve connectedness. 

|- Vf : real~M->real~N s. f contiiiuous_on s A connected s 
^ connected (IMAGE f s) 
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• Properties of convex sets, convex hulls, cones etc. Results include 
Helly's theorem, Caratheodory's theorem, and various classic results 

about separating and supporting hypcrplanes. The following states 
a simpler but not entirely trivial result that convex hulls preserve 
compactness. 

|- Vs:real"N->bool. compact s => compact (convex hull s) 

• Sequences and series of vectors and uniform convergence, Frechet 
derivatives and their properties, up to various forms of the inverse 

function theorem, as well as specific 1-dimcnsional theorems like 
Rolle's theorem and the Mean Value Theorem. Here is the formal 
statement of the chain rule for Prechet derivatives. 

I- Vf :real~M->real"N g:real"N->real~P f g' . 
(f has_derivative f) (at x) A 
(g has_derivative g') (at (f x)) 
=> ((g o f) has_derivative (g' o f')) (at x) 



3.2. Formalizing measure theory. Although the basic Euclidean theory 
is an important foundation, and many of the concepts like 'convex hull' are 
used extensively in the Flyspeck mathematics, perhaps the most important 
thing to formalize is the concept of volume. 

We define integrals of general vector- valued functions over subsets of M^, 
using the Kurzweil-Henstock gauge integral definition. We develop all the 
usual properties such as additivity and the key monotone and dominated 
convergence theorems. We also develop a theory of absolutely integrable 
functions, where both / and |/| are gauge integrable; this is known to co- 
incide with the Lebesgue integral. Here is a formal statement of the simple 
theorem that integration preserves linear scaling: 

I- Vf :real~M->real~N y s h:real"N->real~P. 

(f has_integral y) s A linear h ((h o f) has_integral h(y)) s 

Using this integral applied to characteristic functions, we develop a theory 
of (Lebesgue) measure, which of course gives volume in the 3-dimensional 
case. The specific notion 'measure zero' is formalized as negligible, and 
we also have a general notion of a set having a finite measure, and a function 
measure to return that measure when it exists. For example, this is the basic 
additivity theorem: 

|- Vs t. measurable s A measurable t A DISJOINT s t 

=> measure (s UNION t) = measure s + measure t 
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We have proved that various 'well-behaved' sets such as bounded convex 
ones and compact ones, or more generally those with negligible frontier 
(boundary) are measurable, e.g. 

|- Vs : real~N->bool . bounded s A negligible (frontier s) =^ measurable s 

The main lack at the moment is a set of results for actually computing the 
measures of specific sets, as needed for Flyspeck. We can evaluate most 
basic 1-dimensional integrals by appealing to the Fundamental Theorem of 
Calculus, but we need to enhance the theory of integration with stronger 
Fubini-type results so that we can evaluate multiple integrals by iterated 
one-dimensional integrals. This work is in progress at the time of writing. 



3.3. Enhanced automation. Using coordinates, many non-trivial geomet- 
ric statements in M^, or other Euclidean spaces of specific finite dimension, 
can be reduced purely to the elementary theory of reals. This is known to 
be decidable using quantifier elimination |44| [3l [28]. However, in practice 
this is often problematic because quantifier elimination for nonlinear formu- 
las is inefficient. The problem is particularly severe if we want to have any 
kind of formal proof, as we do in Flyspeck, since producing such a proof 
induces further slowdowns [30], [33|. With this in mind, we have explored a 
different approach to the case of purely universally quantified formulas [26] , 
based on ideas of Parrilo [ID] . This involves reducing the initial problem to 
semidefinite programming, solving the SDP problem using an external tool 
and reconstructing a 'sum-of-squares' (SOS) certificate that can easily be 
formally checked. 

For example, suppose we wish to verify that if a quadratic equation ax'^ -\- 
bx + c = has a real root, then 6^ > 4ac. Using the SDP solver we find an 
algebraic certificate 6^ — 4ac = {2ax + b)"^ — Aa{ax'^ + bx + c), from which 
the required fact follows easily: {2ax -|- 6)^ > because it is a square, and 
Aa{ax'^ -|- 6x -|- c) = because x is a root, and so we deduce 6^ — 4ac > 0. 
This method seems very useful for automating routine nonlinear reasoning 
in a way that is easy and quick to formally verify, so that we don't have 
to rely on the correctness of a complicated program. It is even capable of 
solving the coordinate forms of some of the simpler Flyspeck inequalities 
directly, though it seems unlikely to be competitive with customized non- 
linear optimization methods as described in Section |5] For example, one 
simple Flyspeck inequality is the following, which after being reduced to a 
real problem with 9 variables (three coordinates for each point) is solved by 
SOS in a second: 

II u-v II > 2 A II u-w II > 2 A II v-w \\ > 2 A || u-v \\ < Vs ^ \\ w-{u+v) /2 1| > || u-v \\ /2. 
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A quite different approach to geometric theorem proving is to work in the 
setting of a general real vector space or normed real vector space. In this 
case, other decision methods are available [43] . In particular, one of these 
decision procedures that we have implemented in HOL Light can sometimes 
handle simple forms of spatial reasoning in a purely 'linear' way, and so be 
much more efficient than the direct reduction to coordinates, even if we do 
in fact have a specific dimension in mind. One real example from formalizing 
complex analysis is the following in M^: 

I II w — z II — r| = d A \\u — wW < d/2 A || x — z || = r ^ d/2 < || x — n || . 



4. Standard ML reimplementation of code 



This section describes a reimplementation of the computer code used in the 
proof of the Kepler conjecture. The code has been substantially redesigned 
to avoid various difficulties with the original implementation. 



4.1. Code. The original proof of the Kepler conjecture relies significantly 
on computation. Computer code is used extensively and is central both to 
the correctness of the result and to a thorough understanding of the proof. 

There are four major difficulties with understanding and verifying the orig- 
inal code base. The first and most glaring difficulty is simply the amount of 
code. At the website [10] that posts the code for the original proof there are 
well over 50,000 lines of programs in Java, C-I--I-, and Mathematica (among 
others). This represents only the calculations that Hales did himself. Samuel 
Ferguson also completed many of the calculations with an entirely different 
code bas^ of 137,000 lines of C. By contrast, the proof of the four color 
theorem by Robinson et al. |l2] is less than 3,000 lines of C. 



The second difficulty is in the organization of the code. The calculations 
were done over the space of four years and involved thousands of execu- 



tions of a multitude of independent programs. Section 1.2 identifies three 
main computational tasks: tame graph generation, linear program bound- 
ing, and nonlinear inequality verification. Each of these main tasks consists 
of several subtasks. For example, verifying the inequalities required dozens 
of relatively complicated preprocessing phases where second derivatives of 
the relevant functions were bounded over fixed domains. As another ex- 
ample, many linear programs were solved only after a branch and bound 
period which were recorded in voluminous log files. In an attempt to or- 
ganize the complex web of calculations. Hales devised a labeling scheme to 

^There is a large amount of code copying in Ferguson's code, resulting in a much larger 
code base. The number of distinct lines is difficult to measure 
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uniquely identify the calculations. However, even now some computations 
relied upon by the proof are difficult to find in the original source code. 
To locate, for instance, computation "CALC-821707685" from the original 
proof |22i p. 159], one can search on the website [lOj in vain. While records 
of the computations were made, it is not always an easy matter to find them 
without guidance from the authors. 

The third difficulty lies in the complexity of the implementation. For in- 
stance, the software developed to prove the inequalities upon which the origi- 
nal proof rests is relatively complicated. Processing power at the time (1994- 
1998) was just barely capable of completing the computations requested. To 
keep the length of execution to days or weeks instead of months or years, the 
code is extensively optimized. The optimizations were often implemented 
without comment in the source and in some cases are difficult to understand. 

The fourth difficulty is that the original code uses C and C-|— |- to carry 
out interval arithmetic calculations based on floating point arithmetic. In 
the process, it explicitly sets the IEEE 754 [29] rounding modes on the 
processor's floating point unit. While floating point is desirable for its speed, 
there are difficulties with using floating point for software that requires a 
very high level of rigor such as that supporting mathematical proof. The first 
is that reasoning about floating point instructions requires a relatively deep 
understanding of the machine architecture [35]. For instance, setting the 
rounding mode changes the state of the processor itself. Such an instruction 
has a global effect on all subsequent floating point computations. In the 
original code base the rounding modes are explicitly changed at least 400 
times. Moreover, compilers, libraries, and even processors are notorious for 
unsound implementations of the 754 standard. 



4.2. Reimplementation. In 2004 we decided to reimplement the original 
code base. We decided that the new implementation should not require 
floating point numbers and rounding modes. Though speed was important, 
we wanted the code to be independent of any particular interval arithmetic 
implementation. This meant we could use a fast floating point implemen- 
tation of interval arithmetic for our daily work, but could use a slower but 
more trustworthy implementation such as MPFI [41j to double check im- 
portant computations. We also wanted to organize the new implementation 
such that any of the many computations upon which the proof relies could 
be evaluated from a single interface. This would allow Flyspeck developers 
to find and easily check the text of the proof during the formalization pro- 
cess. Finally, we wished to bring the computational aspects of the Kepler 
conjecture closer to the level of simplicity and clarity necessary for formal- 
ization by a proof assistant. We began this work in the spirit of Robinson et 
al. [12] , which simplified the original code of Appel and Haken [T] , and was 
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used by Gonthier to construct the fully formal proof in the Coq proof 
assistant. 

We chose Standard ML for the reimplement ation for a number of reasons. 
It has a formal definition [M], and thus programs have a meaning apart 
from the particular compiler used. It has an efficient compiler, named ML- 
ton (Our reimplementation runs between 50% and 200% the speed 

of the original implementation compiled with GCC.) MLton has the ability 
to use external libraries written in languages other than SML with relative 
ease. This allowed us, from one programming environment, to control mul- 
tiple linear programming solvers, interval arithmetic implementations, and 
nonlinear optimization packages. SML has an expressive module system, 
and thus it was simple to write our code with respect to an abstract type of 
interval arithmetic. Thus we could use multiple independent implementa- 
tions with ease. As of 2008, most of the code has been completely rewritten 
in SML and is executable from a single command-line program. The code 
is freely available at the project website |31j . 

In the original implementation, the myriad computations were done with 
many different programs written in a half dozen programming languages. 
The results of these computations are not always easy to find or interpret. 
Now all the computations are executed from the same source, with orga- 
nized output. In addition to giving us added confidence that the original 
computations were sound, we have a fairly complete suite of software sup- 
port for the Flyspeck project. We are now in the process of organizing and 
reevaluating the thousands of computations upon which the proof depends. 



5. Proving nonlinear inequalities with Bernstein bases 

The hardest computational part of the original proof of the Kepler conjecture 
is the verification of a list of about a thousand nonlinear inequalities. This 
section presents a technique aimed at proving them, based on polynomial 
approximation and Bernstein bases. We feel that this approach better fits 
the requirements of formal proof, as outlined in Section |4.2[ We hope to 
refine the method to cover all Flyspeck inequalities. 
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We exhibit the method on a single inequahty CALC-586468779. The original 
proof contains the following definitions |9] : 
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The statement of the inequality is: 

(1) Vy G [2,2.51]6.7(y) <pt. 

Define the difference of two intervals by [ai, 61] — [02, ^2] = [«i — ^2) &i — 02]- 
Interval arithmetic is used to prove the inequalities in the original proof. It 
suffers from the dependency problem: the minimum and maximum of the 
formula x — x are overestimated because [a, h] — [a, b] = [a — 6, 6 — 0], although 
X — X is clearly 0. Subdividing [a, 6] into [a, and and then re- 

evaluating the formula yields an improved result. However, depending on 
the problem, the number of required subdivisions can be very large. This is 
why checking some inequalities takes a very long time. 



5.1. From geometrical functions to polynomials. Fortunately, better 
methods than interval arithmetic are available, if the function under consid- 
eration is polynomial. A quick look at 7 tells us that ([T]) is not polynomial, 
since it has occurrences of 1/-, and arctan. Can it nevertheless be re- 
duced to a polynomial problem? Two strategies come to mind: 

First, algebraic laws such as ^/a < b <^ a < b^ {ii b > 0) and ^ < c <^ 
a < 6c (if 6 > 0) can often be used to eliminate occurrences of and 1/-. 
The list of trigonometric identities is endless. For our example, Vega's rule 
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arctan a+arctan b = arctan seems useful. Unfortunately, this technique 
quite often yields huge expressions that are difficult to deal with by virtue of 
their sheer size. Also, an algebraic transformation to a polynomial problem 
may simply be impossible (we suspect that this is the case for (IT]) 



A second technique is based on replacing 7 with a polynomial g that domi- 
nates it, but is still smaller than pt. Clearly, if there exists a g such that 

(2) Vy e [2,2.51]6.7(y) <5(y) 
and 

(3) Vy G [2,2.51]6.5(2/) <pt, 
then by transitivity ([T]) holds. 

Such a polynomial g can be obtained by replacing !/• and arctan with 
polynomial approximations. We only need to ensure that we use upper 
approximations for positive occurrences and lower approximations for neg- 
ative ones. Only occurrences whose arguments contain variables need to be 
replaced, since e.g. \/2 is a (constant) polynomial itself. 

In the definition of 7 the function arctan occurs positively, so it is replaced 
by an upper approximation arctan. The term "^J^^^ is first unfolded to 
Y^A(y) • Both the square root and reciprocal occur positively again 

here, so they can be replaced by upper approximations sqrt and rep, re- 
spectively. This yields arctan(sqrt(A(y)) •rcp(aj(y))) in all four summands. 
There remains only ^ occurring negatively after — ^g^, which is to be re- 
placed by a lower approximation sqrt. 

We choose the following approximations: 

, , V2 25 

arctanlt) := arctan 1 

^ ' 5 27 

1 37t 13t3 



4 1600 1000 640000 6400000 

sqrt(t) := 8\/2 + ^ ^{t - 128) 

64(7r - 4 arctan Y) 

^i{t) :=8y2 + ^(t-128). 



These approximations are valid on the domain ([T]). For example, 
Vt G A([2,2.51]^). ^^t < sqrt(t). 
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This can be established by elementary means, knowing that A([2,2.51]^) C 
[128; 501]. The latter can be shown automatically by the method outlined 
in the next subsection. 

In summary, we arrive at the following definition of g: 

S 2 
9{y) ■= — ^sqrt(A(y)) + - ^ arctan(sqrt(A(y)) • rcp(ai(y))). 

i=0 

In form, it is almost identical to the definition of 7. Our construction of 
g therefore ensures Moreover, the approximations were chosen (using 
polynomial interpolation) in a way such that 

(4) 7(2, 2, 2, 2, 2, 2) = 5(2, 2, 2, 2, 2, 2) = pt. 

This is important, because otherwise ^ cannot hold. 

5.2. Bounding polynomials. In order to prove ([T| , it remains to be shown 
that g{y) < pt. This can be done with the help of Bernstein polynomials. 
We briefly outline the case of a single variable x here. 

The ith Bernstein basis polynomial of order k is defined as 

Bf(x) := Qx\l-x)'~\ 

For a polynomial p and a vector 6 G M'^, if 

k 

p{x) = Y,b^■BHx), 

then b is called the Bernstein representation of p. In this case 

Vx G [0; 1]. p{x) < max6j. 

i 

This property is tremendously useful: it gives us an upper bound on p, 
namely the largest coefficient of p's Bernstein representation. By a change 
of variable we can reduce any interval to [0,1]. The generalization to the 
multivariate case is straightforward [6], |49] . 

In order to bound a polynomial it thus suffices to convert it into Bernstein 
representation. This can be done by a matrix multiplication (the Bernstein 
basis of order k forms a basis of the vector space of all polynomials of degree 
up to k). For practical purposes it is however crucial to use a more efficient 
algorithm (cf. [B], US]). 

Note that g contains irrational coefficients. This is a consequence of re- 
quirement (El) and cannot be avoided. However, we were able to choose 



16 HALES, HARRISON, MCLAUGHLIN, NIPKOW, OBUA, AND ZUMKELLER 



the approximation polynomials in a way such that the transcendental parts 
can be factored out (hence the occurrence of vr — 4 arctan ^ in the defini- 
tion of sqrt). As can be easily checked with symbolic algebra software, the 

polynomial p{y) := \/^{g{y) — pt) has rational coefficients! It can thus be 
converted to a Bernstein representation without rounding, using the algo- 
rithm presented in |l9]. With this method the only divisions are by powers 
of 2, which can be efficiently represented using dyadic numbers. 

The polynomial p consists of 12945 monomials and has total degree 18. A 
prototype implementation in Haskell returns as the maximum for p in 
about half a minute. Thus y/2{g{y) — pt) < and g{y) < pt. 

6. Tame graph enumeration 

Tame graphs are particular plane graphs that represent potential counterex- 
amples to the Kepler conjecture. The Archive is a list of over 5000 plane 
graphs. The original proof generates the Archive with the help of a Java 
program that enumerates all plane graphs. Tameness is defined in Section 18 
and the enumeration is sketched in Section 19 of [22^. This section sketches 
the formally machine-checked proof of Claim 3.13 and Theorem 19.1 in the 
original proof [22]: 

Theorem 1. Any tame plane graph is isomorphic to a graph in the Archive. 

There are two potential reasons why an error in the original proof of this 
theorem might have gone undetected: the publications only sketch the de- 
tails of the enumeration, and the referees only made a passing glance at the 
implementation, consisting of more than 2000 lines of Java. 

We recast the Java program for the enumeration of all tame graphs in logic, 
proved its completeness with the help of an interactive theorem prover, ran 
it, and compared the output to the Archive. It turns out that the original 
proof was right, the Archive is complete, although redundant (there are at 
most 2771 tame graphs). Doing all this inside a logic and a theorem prover 
requires two things: 

• The logic must contain a programming language. We used Church's 
higher-order logic (HOL) based on A-calculus, the foundation of func- 
tional programming. Programs in HOL are simply sets of recursion 
equations, i.e. pure logic. 

• The programming language contained in the logic must be efficiently 
executable and such executions must count as proofs. The theorem 
prover that we used, Isabelle/HOL |37] fulfills this criterion. If all 
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functions that appear in a term are either data, e.g. numbers, or 
functions defined by recursion equations, Isabehe/HOL offers the 
possibihty to evaluate this term t in one big and relatively efficient 
step to a value v, giving rise to the theorem t = v. 

The enumeration of all tame graphs generates 23 million plane graphs — 
hence the need to perform massive computations in reasonable time. 

Now we give a top-level overview of the formalization and proof of complete- 
ness of the enumeration of tame graphs in HOL. For details see |36]. The 
the complete machine-checked proof, over 17000 lines, is available online in 
the Archive of Formal Proofs at a fp . sf .net| |2] . 



6.1. Plane graphs. Following the original proof, we represent finite, undi- 
rected, plane graphs as lists (= finite sets) of faces and faces as lists of 
vertices. Note that by representing faces as lists they have an orientation. 
The enumeration of plane graphs requires an additional distinction between 
final and non-final faces. Hence a face is really a pair of a list of vertices 
and a Boolean. A plane graph is final iff each of its faces is. In final graphs 
we can ignore the Boolean component of the faces. 



6.2. Enumeration of plane graphs. The original proof characterizes plane 
graphs by an executable enumeration and sketches a proof of completeness 
of this enumeration. We have followed the original proof and taken this enu- 
meration as the definition of planarity. The enumeration of plane graphs in 
the original proof proceeds inductively: you start with a seed graph with two 
faces, the final outer one and the (reverse) non-final inner one. If a graph 
contains a non-final face, it can be subdivided into a final face and any num- 
ber of no n- final ones. Because a face can be subdivided in many ways, this 
process defines a tree of graphs. By construction the leaves must be final 
graphs, and they are the plane graphs we are interested in: any plane graph 
of n faces can be generated in n — 1 steps by this process, adding one (final) 
face at a time. For details see [22] or |36j . 

The enumeration is parameterized by a natural number p which controls the 
maximal size of final faces in the generated graphs. The seed graph Seedp 
contains two (p-|-3)-gons and the final face created in each step may at most 
be a (p -f 3)-gon. As a result, different parameters lead to disjoint sets of 
graphs. 

The HOL formalization defines an executable function next-plancp that maps 
a graph to a list of graphs, the successor graphs reachable by subdividing 
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one non-final face. The plane graphs are the final graphs reachable from 
Seedp via next-plancp for some p. 

6.3. Enumeration of tame graphs. The definition of tameness in the 
original proof is already quite close to a direct logical formulation. Hence 
the HOL formalization is very close to this. Of course pictures of graphs 
had to be translated into formulae, taking implicit symmetries in pictures 
into account. We found one simplification: in the definition of an admissible 
weight assignment one can drop condition 3 (a condition on the 4-circuits 
in graphs) without changing the set of tame graphs. What facilitated our 
work considerably was that a number of the eight tameness conditions in 
the original proof are directly executable. The details are described else- 
where [36] . 

The enumeration of tame graphs is a modified enumeration of plane graphs 
where we remove final graphs that are definitely not tame, and prune the 
search tree at non-final graphs that cannot lead to tame graphs anymore. 
The published description [22] is deliberately sketchy, and the precise formu- 
lation of the pruning criteria is based on the original Java programs. This 
is the most delicate part of the proof because we need to balance effective- 
ness of pruning with simplicity of the completeness proof: weak pruning 
criteria are easy to justify but lead to unacceptable run times of the enu- 
meration, sophisticated pruning techniques are difficult to justify formally. 
Since computer- assisted proofs are still very laborious, simplifying those 
proofs was of prime importance. In the end, the HOL formalization defines 
a function next-tamep from a graph to a graph list. It computes the list of 
plane successor graphs next-plancp g and post-processes it as follows: 

(1) Remove all graphs from the list that cannot lead to tame graphs 
because of lower bound estimates for the total admissible weight of 
the final graph. 

(2) Finalize all triangles in all of the graphs in the list (because every 
3-cycle in a tame graph must be a face). 

(3) Remove final graphs that are not tame from the list. 

A necessary but possibly not sufficient check for tameness is used in the last 
step. Hence the enumeration may actually produce non-tame graphs. This 
is unproblematic: in the worst case a fake counterexample to the Kepler 
conjecture is produced, but we do not miss any real ones. 

Although we have roughly followed the procedure of the original proof, we 
have simplified it in many places. In particular we removed the special 
treatment of Seedo and Seedi, which is a fairly intricate optimization that 
turned out to be unnecessary. 
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The following completeness theorem is the key result: 

Theorem 2. If a tame and final graph g is reachable from Seedp via next- 
planep then g is also reachable from Seedp via next-tamcp. 

Each step next-tamCp is executable and an exhaustive enumeration of all 
graphs reachable from a seed graph is easily defined on top of it. We call 
this function tamcEnump. By definition, tame graphs may contain only 
triangles up to octagons, which corresponds to the parameters p = 0, . . . , 5. 

6.4. Archive. In order to build on the above enumeration of all tame graphs 
without having to rerun the enumeration, the results of running tamcEnunip 
with p = 0, . . . , 5 are put into an Archive and isomorphic graphs are elimi- 
nated. This results in 2771 graphs, as opposed to 5128 in the original proof. 
The reasons are twofold: there are many isomorphic copies of graphs in the 
Archive and it contains a number of non-tame graphs, partly because, for 
efficiency reasons, the original proof did not enforce all tameness conditions 
in its Java program. The new reduced Archive is also available online [2]. 

Finally we can prove Theoremjl] if g is tame plane graph, Theorem[2]and the 
definition of tamcEnum tell us that g must be contained in tamcEnump for 
some p = 0, . . . , 5. Hence it suffices to enumerate tamcEnump, p = 0, . . . , 5, 
and check that, modulo graph isomorphism, the result is the same as the 
Archive. This is a proposition that can be proved by executing it (because 
the HOL formalization also includes a verified executable test for graph 
isomorphism which we do not discuss). 

7. Verifying linear programs 

This section reports on the current state of the formal verification of the 
linear programming part of the proof of the Kepler conjecture. The results 
of the linear programming in the original proof are recorded in several giga- 
bytes of log files. This section presents the formalization of the generation 
and bounding of these linear programs in the mechanical proof assistant 
Isabelle ^37j . A more detailed version of the material presented here can be 
found in S. Obua's thesis [38] . 

This formalization relies on the archive of tame graphs. Each tame graph 
(except the graphs associated with the face-centered cubic and hexagonal 
close packings) represents a potential counterexample to the Kepler conjec- 
ture. Each potential counterexample obeys certain constraints. The original 
proof refutes each potential counterexample by building a linear program 
from the constraints and showing that these linear programs are infeasible. 
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Figure 1. A hypermap is a combinatorial structure at- 
tached to a planar graph. A dart, represented as a small 
triangle, is place at each face angle of the graph. In the sec- 
ond frame, the face permutation / cycles through the darts 
in each face. In the third frame, the node permutation n cy- 
cles through the darts at each node. The edge permutation e 
(not shown) is an involution exchanging darts from opposite 
ends of the edge of a graph. (This figure has ben reproduced 
from |23j.) 

A structure, which we call a graph system, makes this precise in a formal 
environment. An instance of a graph system is a tame graph which obeys 
the constraints listed in the definition of a graph system. The current for- 
malization does not use all of the constraints of the original proof but only 
those that do not require branch and bound strategies. Our current notion 
of graph system can be viewed as a detailed formalization of what is called 
basic linear programs in [22, §23.3]. Because the current formalization does 
not capture not all constraints of the original proof, we cannot hope to re- 
fute all potential counterexamples. Nevertheless we manage to refute most 
of them. 

We represent tame graphs as hypermaps [7], [18j. As mentioned in Section |2] 
a hypermap is just a finite set D of darts together with three permutations 
on D: the edge, the face, and the node permutation that compose to the 
identity e o n o / = /. See Figure [TJ This representation greatly simplifies 
the axiomatization of a graph system. For a detailed description of how we 
represent hypermaps and for a complete list of all of the axioms of a graph 
system see j38l §4] . 

Figure [2] summarizes how we generate and solve the linear programs. We 
apply the axioms of a graph system to each tame graph. This results in 
a large Isabelle theorem which is a conjunction of linear equalities and in- 
equalities. We then normalize this conjunction to bring it into the form of 
a matrix inequality 



(5) 



Ax < b. 
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Figure 2. Refuting a potential counterexample to the Ke- 
pler conjecture 

The entries of A and b are symbolic expressions which contain various real 
constants (such as tt) that are needed to define the axioms of a graph system. 
In order to apply linear programming, we need to replace A and b with 
numerical approximations. We achieve this via a formalization of interval 
arithmetic in Isabelle, and arrive at numerical matrices A' , A" and b' for 
which we have the formally proven Isabelle theorems 

(6) A' <A< A", b < b'. 

We then apply a simple preprocessing step which gives us formally proven 
a-priori bounds x' and x" for x such that 

(7) x < X < x". 

It is then possible to obtain a certificate from an external linear programming 
solver like GLPK (Gnu Linear Programming Kit) that allows us to formally 
reach a contradiction from Ax < b. The beauty of a certificate is that we 
can use results obtained from an untrusted source (in our case this untrusted 
source is a heavily optimized linear program solver programmed in C) in a 
trusted and completely mechanically verifiable way. 

In this way, we proved the inconsistency of 2565 of the graph systems but 
failed to prove the inconsistency of the remaining 206. This yields a success 
rate of about 92.5%. Future work will extend the notion of graph system 
and generate linear programs that take all the constraints of the original 
proof into account. 
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Part 2. Addendum to and Errata in the Original Proof 

8. BiCONNECTED GRAPHS 

This section gives further detail to the argument of |14| §12.7 p. 131]. There 
it is claimed that the proof of the main estimate Theorem 12.1] can be 
reduced to the case of polygonal standard regions. This claim is correct. 
However, the justification of this claim is not complete in the original proof. 
This section gives complete justification of the claim. The main result is 
Theorem |3] stated below. 

This section patches the original proof. As such, it should be imagined 
this section to be inserted as an addendum, directly following Section 12.13 
in the original proof, as a new Section 12.14. (In fact. Section 12.13 is 
itself an addendum to the 1998 preprint, making this section the second 
addendum to Section 12.) If the actual insertion were to be carried out, the 
corresponding changes to the numbering of the results in this section would 
be made: Theorem [3] below would be inserted as a new Theorem 12.21, and 
so forth. 

In the original proof, the boundaries of standard regions may fail to be sim- 
ple polygons. In fact, the failure of the boundaries to be polygons may be 
quite severe: the boundaries may contain multiple components and articu- 
lation vertices. An articulation vertex in a graph is a vertex whose removal 
increases the number of connected components of the graph. A connected 
graph is biconnected if it contains no articulation vertex. 

In the original proof, each standard region is first prepared by a process of 
erasure (described in |14l §11.1]), then deformed in a way to transform its 
boundary into a simple polygon. The deformation is made in such a way that 
the values of two key functions voro,R and to,_r are left unchanged. These 
are the functions that enter into the main estimate |14| Theorem 12.1]. 

What the original proof fails to consider is a particular hypothetical situation 
where the deformation might fail. This situation is illustrated in Fig. |3] 
where the rigid movement of set of vertices (such as the illustrated triangle 
with vertex w) is blocked by a nearby vertex v that is not visible from w, 
when the distance between v and w drops to the minimum value 2. This 
section presents a proof that this hypothetical situation does not occur. 

The strategy of the proof in this section is to use a deformation argument. 
A general decomposition star is deformed until the graph attached to it 
becomes biconnected. In a biconnected planar graph with at least three 
vertices, each face is a simple polygon. Thus, by producing a biconnected 
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Figure 3. In this figure (not to scale), segments represent 
geodesic arcs on the unit sphere. The shaded region is a sub- 
region whose boundary is not a simple polygon. We wish to 
rigidly slide the triangle containing the vertex w until a new 
visible distinguished edge forms (say from w to u). We will 
show that this rigid motion does not decrease the distance 
between two vertices (say w and v) to the minimum distance 
2. 

graph, we achieve our objective. In the original proof of the Kepler conjec- 
ture, biconnected graphs are not mentioned by name. Nevertheless, most of 
the graphs that occur in the late stages of the original proof are biconnected. 

In more detail, the proof in this section will produce a sequence of admissible 
deformations of a decomposition star D in such a way that the individual 
standard regions R are preserved in number and identity (but not in shape) 
by the deformations. The deformations will preserve the values of voiq^ji{D) 
and tq^fi{D), for each standard region R. The deformations will change the 
combinatorial structure of the graph formed by all the subregions of the 
decomposition star. At the conclusion of the deformation, the decomposition 
star D will have a graph (formed by all the subregions of the decomposition 
star) that is biconnected. As in the original proof, the decomposition star 
is first simplified by a process of erasure, before the deformations begin. 

In the remainder of this section, we adopt notation, definitions, and conven- 
tions without further comment from |14j . 

8.1. Context. We work in the following restrictive context for Theorem [3] 
and its proof. We fix a packing centered at a vertex at the origin. As 
described in Section 12.6 of the original proof, we assume that all upright 
quarters are erased, except loops (that is, those surrounded by anchored 
simplices). Let U be the set of (non null) vertices of of height at most 2.51. 
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As usual, we say two edges {^1,^2} and {u[, Ug} cross if the interiors of the 
triangles formed by {0,ui,U2} and {0,u'^,U2} intersect. 

We form the set of edges E' between vertices in U, consisting of 

• all standard edges; that is, {v,w} C U such that < — < 2.51. 

• all edges {v, w} C [/ of an anchored simplex, whenever the upright 
diagonal of the anchored simplex is an unerased loop. 

• all edges {v, C [/ such that < || f — -u; || < \/8, where {v, w} does 
not cross any other edge in previous two items. (If two of these edges 
cross, pick only one of them. This can only happen with conflicting 
diagonals of a quad cluster.) 

These edges do not cross. A special simplex {0, n, v, w} has one edge {v, w} 
of length at least \/8, called the special edge. A special edge has length at 
most 3.2. The other vertex u is called a special vertex (or special corner). Let 
E = E' \S, where S is the set of special edges (that is, the edges of special 
simplices shared with an anchored simplex). The projection of the line 
segments formed by E to the unit sphere is a planar graph. The complement 
of this graph in the unit sphere is a disjoint union of connected components. 
The closures of these connected components are called subregions. 

We call a loop suhregion one that contains an unerased loop {0, v}. If i? is 
a loop subregion, then there are no enclosed vertices of height < 2.51 over 
the subregion. The corners of R are the anchors of the upright diagonal 
together with the special corners of the subregion. The subregion R is star 
convex with center point at the projection of v to the unit sphere. It follows 
that the boundary of i? is a simple polygon. 

The graph T with vertices U and edges E is not necessarily connected. The 
aim is to deform U (and D) to create a biconnected graph (without changing 
the values of voro,if,(-D) and tq^r^D) for standard regions R; the values for 
individual subregions will change). Once the graph T is biconnected, the 
subregions are simple polygons as desired. 

The deformation of U is admissible if it satisfies the following three condi- 
tions. 

• If the graph T is not connected, the deformation acts by a rotation 
about the origin on the vertices of a single chosen connected com- 
ponent of r, leaving all other vertices of U fixed. (For example, 
in Figure [S] the entire triangle with vertex w may be rotated.) In 
particular, || , for v £ U, is constant. 
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Figure 4. Theorem [s] breaks into various cases: (a) two 
edges with distinct endpoints, (b) three or more edges, (c) 
two edges, or (d) a single edge passing through the triangle 
{0,v,w}. 

• If the graph T is connected, but not biconnected, with a chosen 
articulation vertex a, then the deformation acts by a rotation about 
the axis {0, a} on the vertices of a single component of r\{a}, leaving 
all other vertices of U fixed. 

• The distance between v, w remains at least 2, for all v,w G U. 

The deformation stops when either of the following halting conditions are 
met: 

(HI) ||f — wll < "v/S, where the edge {v,w} E', with {v,w} C U, does 

not cross any edge in E', or 
(H2) II f — w II decreases to 2 for some v,w £ U, and {v, w} crosses an edge 

in E'. 

We warn that the deformation is allowed to assume configurations in which 
the distance between some u € U and the upper endpoint of an unerased 
upright diagonal d is less than 2. This is not a problem because the vertex 
u does not end up as a corner of the loop subregion to which the upright 
diagonal d belongs. (In particular, the halting condition (HI) prevents a new 
special vertex from being added to a loop subregion.) Thus, when a single 
subregion is considered in isolation, all distances between pairs of vertices 
in that subregion are at least 2. 

In the restrictive context that has been described in this section, we have 
the following result. 

Theorem 3. // the graph T = ([/, E) is not biconnected, then a nontriv- 
ial admissible deformation of U exists. The halting condition (H2) never 
holds. The admissible deformation can always be continued until the halting 
condition (HI) holds. 

We break the proof of Theorem [s] into cases (a), (b), (c), (d) according to the 
number and combinatorial structure of the edges {ui, U2} that pass through 
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the triangle {0,v,w}. See Figure [4| Lemma [4] below gives Case (a): we 
cannot have two such edges {ui,U2} and {u'^, Ug} with distinct endpoints. It 
follows that there is an endpoint U2 shared by every edge that passes through 
the triangle {0,v,w}. Lemma|9]below gives Case (b): there cannot be three 
or more edges. Finally, Cases (c) and (d) of one or two edges {ui,U2} are 
treated in further subsections. Each subsection is organized around one of 



the main cases (with introductory Section 8.2): Cases (a), (b), (c), and (d) 



are treated in the four Sections 8.3 8.4 8.5, 8.6 respectively. 



When U is deformed until the halting condition (HI) holds, a new edge 
{v, w} can be added to E. The theorem is repeated to add further edges, 
until a biconnected graph is obtained. The remainder of this section explains 
why the halting condition (H2) never holds. For this, we assume on the 
contrary, that ||f — ■u;|| =2, where {v,w} belong to different connected 
components of F (if F is not connected) and different connected components 
of F \ {a} (if a is an articulation vertex of a connected graph F). When 
this situation occurs, we say that v,w belong to different bicomponents. 
Without loss of generality, we may also assume that {v,w} crosses some 
edge of E'. 



8.2. Preliminary lemmas. Lemma [T] below shows that a vertex does not 
cross over an edge during a deformation; the halting conditions for the vertex 
are met before it reaches the edge. Recall that the term geometric consid- 
erations refers to a specific collection of methods introduced in [22] §4.2] 
to prove the existence and non-existence of various simple configurations of 
points in M^. 

Lemma 1. Let S = {0,v, ,ui,U2} be a set of four distinct points in M.^ whose 
pairwise distances are at least 2. Suppose that \\u\\ < 2.51, for all u £ S. If 
the segment {0,v} meets the segment {ui,U2}, then \\v — ui\\ , \\v — U2\\ < 
2.51. 



Proof. This follows by geometric considerations. □ 



The next two lemmas give conditions under which the halting condition (H2) 
cannot hold. 

Lemma 2. Let S = {v,w,ui,U2,vq} be a set of five distinct points in 
whose pairwise distances are at least 2. Suppose that the segment {v,w} 
passes through {vo,ui,U2} ■ Assume 

II ui — ^^2 II < 3.2, 

ll'Wo — ^^11 < 2.51, for u £ S. 

Then \\v — w\\ > 2. 
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Proof. This follows by geometric considerations. □ 

Lemma 3. Let S = {v,w,ui,U2,vo} be a set of five distinct points in 
whose pairwise distances are at least 2. Suppose that the segment {ui,U2} 
passes through {vo,v,w}. Assume 

II ui - n2|| < 2.91, 

ll'Wo — ^^11 < 2.51, for u £ S. 

Then \\v — w\\ > 2. 

Proof. This follows by geometric considerations. □ 

By Lemmas [2] and |3] we may assume that for each edge {ui, M2} that {v, w} 
crosses, we have that {^1,^2} passes through {0, v, w} and that || U1 — U2 \\ > 
2.91. This means that the edge {ui,U2} is an edge of an anchored simplex, 
so that the edge is special or bounds a loop subregion. This loop subregion 
will provide the key to the proof, because we will show that it prevents the 
distance between v and w from becoming 2, as assumed (Fig. |5|. 

Remark 1. As an aside, we mention that this issue of hiconnected graphs 
is a major issue only in the proof of the Kepler conjecture and not in the 
proof of the dodecahedral conjecture |2H]. In the proof of the dodecahedral 
conjecture there are no loops of anchored simplices, and without loops there 
are no difficulties: edges of length at most \/8 can he he used instead of the 
set E' . Lemmas ^and^ suffice. 



8.3. Case (a): Edge crossings with distinct endpoints. 

Lemma 4. There does not exist a set S = {0, w, tw, ui, ti2, u'l, M2} of seven 
distinct points in whose pairwise distances are at least 2 and that satisfies 
the following conditions. 

• The edges {ui,U2} and {u'^^u^} do not cross. 

• The edges {ui,U2} and {u'i,u'2\ hoth pass through {0,u,u)}. 

• II u II < 2.51 for all u £ S. 

• II f — tt; II = 2. 

• II til — U2 II , II u[ — u'2 II < 3.2. 

• ui and u'^ lie in the same half-space hounded hy the plane {0,?;,^}. 

• The directed segment from v to w crosses the segment {"^'1,^2} hefore 
the segment {ni,n2}. 

Note that the last two conditions can always be achieved by suitable labels 
on the points {ui, U2, u'^, u'2}. 
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Figure 5. In this figure (not to scale), segments represent 
geodesic arcs on the unit sphere. The two shaded regions 
represent sub regions. There are possibly other subregions 
partitioning the unshaded portions of the figure. These other 
subregions are not represented in this figure. The shaded re- 
gion marked L represents a loop subregion. The other shaded 
region represents a subregion with two boundary components 
that is undergoing a deformation, by the motion of the tri- 
angle with vertex v. The situation of Fig. [3] does not exist 
(as will be shown). The intervening loop subregion L forces 
V and w to be more than the minimum distance apart. 

Proof. This will follow as a direct consequence of Lemmas[6]and[8]below. □ 

Lemma 5. Let S = {n, f , he a triangle such that each side has length at 
least 2, and such that || n — f || < 2.51, || u — w || < 2.51, || — w || =2. Let 
X he the set of points in the convex hull of S that have distance at least 1.2 
from each vertex of S. Then the diameter of X is less than 1.044. 

Proof. Let x = \u — v\ and y = \u — w\. Assume x > y. As u moves 
away from along a fixed line through v and an initial position uq^ the 
region X expands. Thus, we may assume that x = 2.51. The boundary 
of X is a polygonal curve consisting of line segments and concave arcs of 
circles. The diameter is realized by the distance between two vertices Pi{y) 
of the polygonal curve. We consider two cases according to y < 2.4 and 
y > 2.4 because the structure of the polygonal curve changes at y = 2.4. We 
calculate \pi[y) — Pj{y) \\ directly, checking for each that the distances 
are less than 1.044. □ 

Lemma 6. Let S = {0, , v, w, ui,U2,u'^, u'2} C 6e a configuration of seven 
points that satisfies the conditions of Lemma Then there exist a point p 
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on the segment {ui,U2} and a point p' on the segment {u'^^u^} such that 
\p-p'\ < 1.044. 

Proof. Let u G {0,v,w}. By the metric constraints, the distance from u to 
the segment {ui,U2} (resp. is at least 

^22- (3.2/2)2 = 1.2. 

Let p (resp. p') be the point of intersection of the segment {ui,U2} (resp. 
{u'i,u'2}) with the convex hull of {0, v, w}. By Lemma[5] we have \\p — p' \\ < 
1.044. □ 

Lemma 7. Let S = {ui, u'^, U2, C M'^ 6e a set of four distinct points 
such that the distance between each pair of points is at least 2. Assume that 

II ui — ^2 II < 3.2, II u\ — u'2 II < 3.2. 

// any of the following conditions hold: 

(A) II ui - u'2 II , II u'l - n2 II > 2.91; 

(B) II ui — li'^ II , II U2 — ^2 II > 2.85, ll'^i— m > 2.91; or 

(C) II ui - -u'l II > 3.64, II m - u'2 II > 2.91; 

then every point on the segment {ni,-U2} has distance greater than 1.044 
from every point on the segment {u'i^u'q}- 

Proof. Assume for a contradiction that the assumptions hold and that the 
conclusion is false for some configuration. The metric constraints can be 
used to show that the segments {wi, U2} and {ti'i, m can be stretched along 
their axes without decreasing any edge length. Thus we may assume without 
loss of generality that ||«i— tt2|| = im— 'U2II =3.2. Decreasing one dihedral 
angle of the simplex at a time, we may move the segments closer together, 
until all four edges attain their minimum length. Then we have 

three rigidly determined simplices (A), (B), (C) (with equality constraints). 
An explicit coordinate calculation of the distance between the two segments 
shows that the distance is greater than 1.044 in each case. □ 

Lemma 8. Let S = {0, , v, w, ui, U2, u'l, u'2} C 6e a configuration of seven 
points that satisfies the conditions of Lemma Then there do not exist a 
point p on the segment {ui,U2} and a point p' on the segment {^'^,^2} such 
that IIp-^II < 1.044. 

Proof. Assume for a contradiction that such p,p' exist. In Lemma [7| we may 
assume that none of the conditions A, B, C hold. By obvious symmetry, 
without loss of generality, we may assume by case A that || U2 — u'^ \\ < 2.91. 
By Lemmajsj this implies that {u'l, U2} does not pass through {0, v, w}. By 
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the conditions of the lemma, the segment {ui,u'i} does not meet the plane 
{0,v,w}, so that {ui,u[} does not pass through {0,v,w}. This means that 
the triangle {ui,u[,U2} is linked around {0, v, w}; and some edge of {0, v, w} 
passes through {ui,u[,U2}. Up to symmetry there are two cases: (1) {0,?;} 
passes through {ui,u[,U2}, or (2) {v,w} passes through {ui,u[,U2}- 

In the first case, recall that {n'^, does not cross {ui, U2}. So n'g is enclosed 
over {0,{ui,u'i,U2})- Then {u'2,ui} and {u'2,u'i} pass through {0,v, w}. By 
Lemma [sj we have || U2 — ui || , || U2 — u\ \\ > 2.91. As we are assuming that 
C does not hold, we have — u[\\ < 3.64. We claim that {0,1(2} passes 
through {ui,u[,U2}- Otherwise, u'2 lies in the convex hull of {0,ui,Ui,U2} 
and a coordinate calculation shows that the upper bounds on the edges 
of the simplex {0,ui,u'i,U2} are inconsistent with the lower bounds on the 
distances from U2 to the vertices of the simplex. Since {0, U2} passes through 
{ui,Ui, U2} we may use geometric considerations to show that || || > 2.51. 
This is contrary to the hypotheses of Lemma |4j 

In the second case, {v, w} passes through {ui,u'i,U2} and through {u'i,U2,U2} 
Geometric considerations give || ui — u'l \\ > 2.85 and || U2 — ""2 || > 2.85. As- 
suming that B does not hold gives — ^^2 II < 2.91. The first paragraph 
of the proof now gives that {u2,U2,ui} links around the triangle {0,v,w}. 
The edge {vjw} does not pass through {u2,U2,ui}. (This can be seen by 
drawing the relative positions of p{u), for u £ S, m the projection p of the 
points to a plane orthogonal to {v, w}.) Thus, we are in the first case, which 
has already been treated. □ 

8.4. Case (b): Triple edge crossings. By Lemma |4| there is a common 
endpoint U2 such that every edge of E' that passes through {0, v, w} has U2 
as an endpoint. Next we show that there cannot be three such edges. 

Lemma 9. There does not exist a set of seven distinct points 

S = {0,V,W,Ul,u'i,Ui,U2} 

in M'^ that satisfies the following conditions. 

• The distance between each pair of distinct points in S is at least 2. 

• The edges {ui,U2}, {u'i,U2}, and {ui,U2} pass through {0,v,w}. 

• II M II < 2.51, for all u & S. 

• II f — II = 2. 

• II M — n2 II < 3.2, for u = ui,u'i, u'(. 

Proof. Assume for a contradiction that S exists. We may pivot w around the 
axis {0,f} until — n2|| < 2.51. (The metric constraints on edge lengths 
show that the condition A > is preserved for the simplices {u,U2,v,'w} 
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and {u, U2, w, 0}, for u = ui,u'i, u", throughout this pivot.) A similar pivot 
of V gives II u — U2 II < 2.51. We may order the vertices in cychc order around 
{0,1*2} as 

{wi,W2,W3,Wi,W5) = {w,Ui,u[,u'l,v), 

SO that setting d{wi,'Wj) = dih{0, U2,Wi,Wj), we have 

4 

d{wi,W5) = y^^d{Wi,Wi+i) > d{'W2,W3) + d{w3,Wi). 

1=1 

Interval calculation^ give d{w2,W3),d{w3,W4) > 0.7 and d{wi,W5) < 1.4. 
We obtain an immediate contradiction: 

1.4 > d{wi,W5) > 0.7 + 0.7. 

□ 

8.5. Case (c): Double edge crossings. This subsection treats the case 
of two edges crossings in the proof of Theorem [3] We continue to assume 
the general context of Theorem [3} As usual, the edge {Mi,n2} G E' crosses 
{v,w}. 

Lemma 10. Let {ui,U2,'w,v} be a set of four distinct points in (in the 
given context). Assume that \\v — Ui\\ < 2.51, for i = 1,2. Assume that 
no edge of E' crosses {v, in the open half-space A containing v bounded 
by the plane {0,ui,U2}- (That is, {ui,U2} is the first edge to cross {v,w}, 
moving from v toward w.) Assume there is a loop subregion L along {iti, M2} 
on the Aside of {ui,U2} ■ Then {ui, U2} is a special edge of E' with corner v. 
In particular, {ui,U2} E, so that it is not a bounding edge of a subregion. 

Proof. Assume for a contradiction that {ui,U2} is not special. Note that 
loop subregions have simple polygonal boundaries and remain rigid under 
all the deformations. In particular, the upright diagonal, special corners, 
and so forth remain rigidly positioned with respect to the corners of the 
subregion. 

Since there are no further edges crossing {v,u!}, the subregion L extends to 
V. Hence v is a corner of the subregion L. It is either an anchor or a special 
corner (with respect to L). However, it cannot be a special corner, by the 
assumption that {ui, U2} is not a special edge. Hence it is an anchor. Also, 
ui and U2 are anchors. 

To reach a contradiction, we consider possible locations of the upright diag- 
onal {0,n}, and show that it has nowhere to go (Figure [6|. Since {ui,U2} 
is an edge, the points ui,U2 are consecutive anchors. This prevents u from 
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Figure 6. The upright diagonal u cannot be placed over 
any of the regions A, B, C, D. The lines (not to scale) repre- 
sent geodesic arcs on the sphere passing through the pairs of 
points in {p{ui) , p{u2) , p{v)} , where p denotes projection to 
the unit sphere. 

lying over the region B. Also, the upright diagonal of any unerased loop 
has at least four anchors (say v,ui,U2,w). Moreover, some anchored sim- 
plex around the upright diagonal is not an upright quarter (because of the 
edge {ui,U2})- Geometric considerations based on these constraints (say 
II — II ^ 2.51) show that the fourth anchor w is not in A. This prevents 
u from being located over the region A. A vertex uj cannot be enclosed over 
an upright quarter {0,u,v,Ui}. This excludes region C. Finally, an edge 
{v,Ui} of length at most 2.51 cannot pass through a triangle {0,u,Uj} of 
sides at most 2.51, 2.51, \/8 (excluding D). □ 



Lemma 11. Let {ui,U2,w,v} be a set of four distinct points in (in the 
given context). Assume that \\v — Ui\\ < 2.51, for i = 1,2. Assume that 
no edge of E crosses {f , in the open half-space A containing v bounded 
by the plane {0,ui,U2}- (That is, {ui,U2} is the first edge to cross {v,w}, 
moving from v toward w.) Then both edges {ui,v} and {u2,v} belong to E. 
In particular, there is a circuit of the graph F through v,ui,U2- 



Proof. If there is a loop subregion L along {ui,U2} on the A-side of {ui,U2}, 
Lemma 10 implies that {ui,U2} is a special edge of E' with corner v. In 
particular, {ui,v} and {u2,v} are edges of E. The conclusion follows in this 
case. 



Now assume that there is no loop subregion along {ui, U2} on the A side of 

{ui,U2}. 

Let S be the finite set of points of U enclosed over the simplex {0, ui,U2,v}. 
We show by contradiction that S is empty. The plane {0, v, w} separates 
S into a disjoint union S = Si L) S2, according to those in the same half- 
space as Ui, i = 1,2. We form the convex hull of the projection p to the 
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unit sphere of the points SiU {ui,v}. As in [HI §12.13], form a sequence of 
geodesic arcs on the unit sphere from p{ui) to p{v). Let p{wi)^ for Wi E Si, 
be the other endpoint of the arc starting at p{ui) (or set Wi = v \i Si = 0. 
For some w' G {wi,W2} \ {v}, the edges {w\ui} do not cross any edges of 
E. Furthermore, geometric considerations show that \w' — Ui\ < 2.51, for 
i = 1,2. By the criteria for forming edges of E, we must have {w',Ui} £ E 
for i = 1,2. This contradicts the assumption that {v,w} does not cross any 
edges of E over A. Hence 5" = 0. 

Since 5 = 0, the edges {v,Ui} do not cross any edges of E. By the criteria 
for forming edges of E, they belong to E. This completes the proof. □ 



We are ready to prove the next major case of Theorem [3| We continue 
to work in the general context of that theorem, with v and w in different 
bicomponents of the graph F. 

Lemma 12. In this context, there does not exist a set of six points {0, v, w, ui,u'i,U2} 
where {ui,U2} and {u'^,U2} pass through {0,v,w} and such that 

II ui — II < 3.2, II u'l — ii2 II < 3.2. 



Proof. We argue by contradiction. We may assume that {ui, u'^} are ordered 
so that the cyclic order around {0, U2} is {wi, 'W2,W3,Wi) = {v, u[,ui, w). By 
the previous results, there are at most two edges that pass through {0, v, w} 
in this manner. In particular, the part of the line segment {v, w} between 
the crossings of {ni, ^2} and {u'l, U2} lies in a single subregion L. 



We claim that we do not have || v — u'^W, || u — n2 || , || — ui || , \\w — U2 \\ < 
2.51. Otherwise, we break into two cases and derive a contradiction as 
follows. Either (1) L is a loop subregion, or (2) L is not a loop subregion, 
but both regions adjacent to L (along edges {ui,U2}, {u'i,U2}) are loop 
subregions. In case (1), {ui,U2,u'i} are corners of the loop subregion L. 
Hence, they lie on a circuit in F formed by the corners of that loop subregion. 



If II 7; — U2 II , II f — "ii'i II < 2.51, then by Lemma 11 the points {v, u'^,U2} lie on 
a circuit in F. A similar conclusion holds if corresponding inequalities hold 
II w — M2 II , II i/^ — til II < 2.51. If all four inequalities hold, then these circuits 
put v,w m the same bicomponent of F, which is contrary to hypothesis. In 



case (2), then by Lemma 11 {v , U2} , {v , u'^} £ E, so {u[,U2} is a special 
edge and L is a loop subregion. This is contrary to the assumption of case 
(2). Hence we may assume by symmetry and without loss of generality that 
II V — u'l II > 2.51 or II f — U2 II > 2.51. 



We may stretch along the edges {u2, ui}, {u2,u'{\, moving ui, u[, until || U2 — 
II = II ^2 — u'l II = 3.2. We may add inequality 

||ti2|| < 2.23, 
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for otherwise by geometric considerations ||m2— "UxH > 3.2. Similarly, \\u'i\\ < 
2.23. If ||u2 — ^^11 > 2.51, we may pivot v toward U2 around the axis {O,?/;} 
until II tt2 — II < 2.51. Similarly, we may assume that || M2 — ''w || < 2.51. Set 
d{i,j) = dih{0, U2,Wi,Wj). Then interval arithmetic calculation^ give the 
contradiction: 

1.3 > d{l,4) = (i(l,2) +d(2,3) + d(3,4) > 0.5 + 0.8 + = 1.3. 

□ 



8.6. Case (d): Single edge crossings. This subsection treats the proof 
of Theorem |3] in the case of a single edge crossing {ui,U2}- This is the final 
case of the proof. We continue to assume the notation and general context 
of that theorem. In particular, v and w lie in different bicomponents of the 
graph r. 

Lemma 13. Let {0,ui,U2,v,'w} be a set of five distinct points such that 
{ui,U2} is the only edge of E' that crosses {v,w}. Then \\v — wW > 2. 



Proof. We assume for a contradiction that ||?; — =2. We consider four 
cases depending on lengths. 



Case 1: \u — Ui\ < 2.51, for i = 1,2 and u = v,w. By Lemma 11 there are 
circuits running through {u,ui,U2}, for u = v,w. This is contrary to the 
assumption that v,w lie in different bicomponents of the graph T. (In the 
remaining cases, there is no loss in generality to assume || w — n2 || > 2.51.) 

Case 2: \w — U2\ > 2.51, — ni|| > 2.51. Geometric considerations give 
the contradiction || ui — ^^2 || > 3.2. 

Case 3: || li; — n2 || > 2.51, ||z; — n2|| > 2.51. Geometric considerations gives 
the contradiction || ui — ^i2 || > 3.2. 

Case 4-' II — "^2 II > 2.51, || t> — tij || < 2.51, for i = 1,2. The edge {ui, M2} 
cannot be a special edge of E' . Otherwise, v, w are corners of the same loop 
subregion. This contradicts the running assumption that these two vertices 



belong to separate bicomponents of the graph T. By Lemma 10 there is no 
loop subregion along {ui,U2} on the ?;-side. Since {ui,U2} has length greater 
than ^/8, there is a loop subregion L bounded by the edge, and it must then 
lie on the tn-side. Thus, w is a corner of L and the circuit of T described by 



the boundary of L passes through w,ui,U2. By Lemma 11 there is a circuit 
of r through v,ui,U2. Hence, v,vj lie in the same biconnected component, 
which is contrary to the running assumption. □ 
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9. Errata listing 

The abridged version of the Kepler conjecture in the Annals [TI] was gener- 
ated by the same tex files as the unabridged version in [25] . For this reason, 
it seems that every correction to the abridged version should also be a cor- 
rection to the unabridged version. We list errata in the unabridged version. 
The same list applies to corresponding passages in the abridged version. 

Each correction gives its location in |22|. The location i+n counts down 
from the top of the page, or if a section or lemma number is provided, it 
counts from the top of that organizational unit. The location £-n counts 
up from the bottom of the page. Footnotes are not included in the count 
from the bottom. Every line containing text of any sort is included in the 
count, including displayed equations, section headings, and so forth. The 
material to the left of indicates original text, and material to the right 
of the arrow gives replacement text. The original text and replacement text 
appear in italic. Comments about the corrections appear in roman. 

In addition to the corrections to the text mentioned below, there have been 
some corrections to the computer code, including some typos in the listings 
of nonlinear inequalities. They are described in detail in [S]. 



9.1. Listing. 

[p.47,Lemma 5.16] Q F 

[p. 49, £+2] supposed suppose 

[p. 63, Lemma 7.10] S-system ^ Q-system 

[p. 75, Remark 8.11] show^ shows 

[p. 78, ^-7] constraints constraint 

[p.86,i'+14] Let {0,f} be the diagonal of an upright quarter in the Qq ^ Let v he 
a vertex with 21^ < \v\ < \/8- Section 9 assumes that the diagonal belongs to a 
quarter in the Q-system, but Lemma 10.14 uses these results when {0,w} has or 
1 anchors. To make this coherent, we should assume throughout Section 9 that we 
have the weaker condition that whenever {0, u} has two or more anchors, it is a 
diagonal of a quarter in the Q-system. The proofs of Section 9 all go through in 
this context. (Lemma 9.7 is all that is relevant here.) 

[p.87,Definition 9.3] In definition of A{v, W^), we can have some Q (as in Fig 9.1) 
with negative orientation. In this case, E^OEi can clip the other side. We want the 
object without chpping. A(u, W^) should be understood as the undipped object. 
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[p. 88, Definition 9.6] The definition is poorly worded. First of all, it requires that 
the subscript to e to be a vertex, but then in the displayed equation, it makes 
u'/2 the subscript, which is not a vertex. To define e', move from wjl along the 
ray through x' until an edge of the Voronoi cell is encountered. If v,w,u are the 
three vertices defining that edge, then set e'^{A,x) = u. Degenerate cases, such as 
when two different edges are encountered at the same time, can be resolved in any 
consistent fashion. In [TH], these degeneracies are avoided altogether, by replacing 
functions e, e' with sets <&, <&'. 

[p. 88, Lemma 9.7,^+2] w and v-^w and u 

[p.88,L. 9. 7, Claim 1] with \w — w'\ < 2tQ, and with 

[p.88,L. 9.7,m] Then: Let R'^ = {x r\ (0,{u,w}) | eo{x,{u,w}) ^ u). 

Assume that R'^ is not empty. Then: 

[p88,L. 9.7,Claim 3] R^ R'^ 

[p.89,£+2] {w,v} {w,u} 

[p. 92,^+16,^+21] maxj maxj 

[p. 93, ^-4] obstructed from w obstructed from w' 

[p.93,i'-2] from some for some 

[p.99,£+l] start star 

[p. 105, Lemma 10.14] In the proof of the cases involving or 1 anchor, a combination 
of the decompositions from Section 8.4 and Section 9 are used. These decompo- 
sitions haven't been shown to be compatible. Instead, it is better to combine 
A('i;, W) with to-truncation on the rest of the quad-cluster. With a tg truncation, 
we no longer have the non-positivity results from Section 8. (The quoins give a 
positive contribution.) However, a routine calculation shows that the estimate on 
A{v, W) is sufficiently small so that we still obtain a constant less than — 1.04pt. 

[p.ll6][p.l21] Definition 11.7 allows masked flat in definition of 3-unconfined. Def- 
inition 11.24 requires no masked flats in the same definition. Use Definition 11.24 
(no masked flats), rather than 11.7. Where masked flats occur, treat them with 
Lemma 11.23, parts (1) and (2). 

[p. 116,^+1] Lemma A. 16 Lemma 4.17 

[p. 117, before Lemma 11.9] two others three others 

[p.ll7,Def 11.8] yl yi 

[p. 119, Definition 11.5] By definition, we require a masked flat quarter to be a strict 
quarter. 

[p.l21] See p.116. 

[p.121,^-5] 0.2274 0.02274 
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[p. 123. flat case (2)] It is missing isolated quarters cut from the side. To fix this, 
in condition 2(f), 77456 > \/2 -^77456 > \/2 or 77234 > \/2 

[p. 124, Lemma 11.27] The bound of is established in Theorem 8.4 ~^ The bound 
of for upright quarters appears in Lemma 8.12. The bound of for the other 
anchored simplex appears in Lemma 8.7 or 8.13, depending on the circumradius. 

[p. 126] Theorem 12.1 should include aii{D) < Sn with S3 = Ipt and S4 = 0, and 
tr{D) > ^3 = 0. 

[p. 131] Section [S] gives the deformation arguments that produce a biconnected 
graph. 

[p.l39,Lemma 12.18,proof,£+3] Co(|w|,7r) Q(|i;|,7r) 

[p.l39,Lemma 12.18,proof,£+6] ro(C7o"(2^o, ^)) - W ^ to{C^{2.2,tt)) ~ tt^^x 
[p.l44,^+ll,£+17] 2tl (2to)2 

[p. 146] of 3-crowded, 3-undefined, and 4- crowded combinations 

[p. 148, §13. 6] This entire section is misplaced. It belongs with §25.5 and §25.6. 

[p.l49,before 13.7] the diagrams Figs 25.1-25.4 

[p. 149, p. 156] The definition of Sioop was accidently dropped from the published ver- 
sion. Set (5ioop(4,2) = 0.12034 5ioop(5,l) = 0.24939. These constants and their 
properties appear in the earlier 2002 arXiv preprint of the proof The Kepler con- 
jecture (Sphere Packings VL). 

[p. 156, Lemma 13.5, i?+4] respectively for tj^(D) respectively, for a ii{D) and Tf((D) 
[p. 164,^-1] This shows. . . occur. This completes the proof. 

[p. 173,^+4] Insert the subscript on b, as in Proposition 15.5, starting on page 173: 
b -^bq. 

[p. 182, Lemma 16.7] The bound of has not been shown to hold on each half. This 
is not a direct consequence of Theorem 8.4 as claimed. This can be fixed as follows. 
Let vi , V3 be the corners giving the endpoints of the long edge of the acute triangle 
at 0, and let V2, U4 be the other two corners. If either vertex vi, V3 has height greater 
than 2.3 show that the voro-scored quad cluster scores less than — 1.04pt. For this, 
we may use the deformations of Lemmas 12.10. The length of the diagonal along 
the acute face remains fixed and at least -s/S. We claim these deformations produce 
a diagonal of length less than ^/S between opposite corners of the quadrilateral. (If 
not, the deformations produce a rhombus with side 2 and diagonals both greater 
than \/8, which is a geometric impossibility.) We cut the quad cluster along the 
diagonal of length \/8 and continue with deformations until the top edges on each 
simplex are (2/4,7/5,2/6) = (2,2,v^). We may apply CALC-474496219 and CALC- 
8990938295 to the two separate simplices to obtain the result. Now we may assume 
that the heights of tji, ^3 are at most 2.3. If either height is at least 2.1, the result 
follows from CALC-5127197465, which gives the bound of on each half. 
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Finally, wc have the case where both heights are at most 2.1. We may apply 
dimension-reduction techniques so that that the each of the two remaining corners 
V vi,V3 of the quad cluster either has height 2 or has distance 2 from vi or v^. 
We then reprove Lemma 16.8 without using the bound of and Lemma 16.9 for 
tetrahedra without the bound — 1.04pt. This appears in CALC-1551562505 and 
CALC-3013446042. 

If the dimension reduction drops the cross-diagonal {v2, V4} all the way to \/8, then 
we may swap diagonals and continue, until both diagonals are exactly \/8. In this 
case, by the cases already considered, we may assume that each corner has height 
at most 2.1. Also, geometric considerations give that the other edges are at most 
2.02: 

f (2,2,2, 78,2.1,2.1,2,2,2.02) > ^8. 
The result follows in this case by CALC-4723770703. 

[p. 241] Mixed is defined so as to include the pure analytic case. In earlier articles, 
'mixed' excludes the pure analytic, mixed mixed or pure 

[p. 243,^+13, £+14,^+15] Delete three sentences: 'Let V12 be . . . We let . . . Break the 
pentagon . . .' 

[p. 248, last displayed formula] = ~^-|- so that it reads 

i 

[p. 252, §25. 7, Cases 2 and 3] 'The flat quarter' is mentioned, but there are no flat 
quarters that have been introduced into the context. This passage has been dis- 
placed from its original context, 
[p. 254,^-1- 7] to branch combine -w to combine 
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